refactor(chapter-10): split routes into modules with validation and access guards

Chapter: 10 - API boundaries.

Plain-English map:
Introduce a module layer for API routes, validate incoming request shapes with
Zod, and add authorization checks around tabular document access.

Why it matters:
Large route files make it hard to see where trust boundaries are. Validation
and access checks need to sit at the boundary before data reaches deeper code.

Principle:
Validate inputs and authorize data access close to the edge of the system.

Precedent borrowed:
Upstream PR Open-Legal-Products#155 and the fork report's strongest security signal: multiple
forks independently patched CWE-639 style tabular-document access bugs.

Upstream base: Open-Legal-Products/mike@d39f580.
Original local commit: f913869.

Author: amal66

apps/api/src/modules/chat/chat.repository.ts

@@ -0,0 +1,2 @@
+// Chat persistence helpers should move here as route handlers are thinned.
+export {};